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United States District Coijri . 

for the 

Eastern District of Virginia ^-25 201/ 

In the Matter of the Search of ^ UfldOT Sesl 

(Briefly describe the property to be searched ) 

or identify the person by name and address) \ Case No. 1:17S W449 


THE PREMISES LOCATED BHMMSRRB 
'^SuWALEXANDE \ ' GINIA22 14 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of peijury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A 

located in the _ East ern District of_ Virginia _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
fif evidence of a crime; 

sf contraband, fruits of crime, or other items illegally possessed; 

S ( property designed for use, intended for use, or used in committing a crime; 
□ a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 

Code Section 
See attached Affidavit. 


Offense Description 


The application is based on these facts: 

See attached Affidavit. 

I?f Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days: _) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 

Reviewed by AUSA/SAUSA: 

Sworn to before me and signed in my presence 
Date: 07/25/2017 

City and state: Alexandria, VA _ 



Printed i 


and title 
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ATTACHMENT A 


The Property to Be Searched 

The premises to be searched (the “Subject Premises”) is the condominium unit located at 
m^mUfillBmil^^lexandria, VA 22314, including the storage unit numbered H 
I, as well as any locked drawers, containers, cabinets, safes, computers, electronic devices, and 


storage media (such as hard disks or other media that can store data) found therein. 
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ATTACHMENT B 


Items to Be Seized (or, in the alternative, identified) 

1. Records relating to violations of 31 U.S.C. §§ 5314,5322(a) (failure to file a report 

of foreign bank and financial accounts); 22 U.S.C. § 611, et. seq. (foreign agents registration act); 
26 U.S.C. § 7206(1) (filing a false tax return); 18 U.S.C. § 1014 (fraud in connection with the 
extension of credit); 18 U.S.C. §§ 1341,1343, and 1349 (mail fraud, wire fraud, and conspiracy to 
commit these offenses); 18 U.S.C. §§ 1956 and 1957 (money laundering and money laundering 
conspiracy); 52 U.S.C. §§ 30121(a)(1)(A) and (a)(2) (foreign national contributions); and 18 
U.S.C. §§371 and 2 (conspiracy, aiding and abetting, and attempt to commit such offenses) 
(collectively, the “Subject Offenses”), occurring on or after January 1, 2006, including but not 
limited to: 

a. Any and all financial records for Paul Manafort, Jr., Kathleen Manafort, Richard 

Gates, or companies associated with Paul Manafort, Jr., Kathleen Manafort, or 
Richard Gates, including but not limited to records relating to any foreign financial 
accounts and records relating to payments by or on behalf of any foreign 

government, foreign officials, foreign entities, foreign persons, or foreign 

principals; 

b. Any and all federal and state tax documentation, including but not limited to 
personal and business tax returns and all associated schedules for Paul Manafort, 
Jr., Richard Gates, or companies associated with Manafort or Gates; 

c. Letters, correspondence, emails, or other forms of communications with any 
foreign financial institution, or any individual acting as the signatory or controlling 
any foreign bank account; 

d. Records relating to efforts by Manafort, Gates, or their affiliated entities to conduct 

activities on behalf of, for the benefit of, or at the direction of any foreign 

government, foreign officials, foreign entities, foreign persons, or foreign 

principals, including but not limited to the Party of Regions and Viktor 
Yanukovych; 

e. Records relating to, discussing, or documenting Telmar Investments Limited, 
Tiakora Ventures Limited, Lucicle Consultants Limited, Actinet Trading Limited, 
Black Sea View Limited, Bletilla Ventures Limited, Evo Holdings Limited, Global 
Highway Limted, Leviathan Advisors Limited, Loav Advisors Limited, Peranova 
Holdings Limited, including but not limited to bank records, canceled checks, 
money drafts, letters of credit, cashier’s checks, safe deposit records, checkbooks, 
and check stubs, duplicates and copies of checks, deposit items, savings passbooks, 
wire transfer records, and similar bank and financial account records; 

f. Physical items purchased through the use of funds from Cypriot accounts, including 
but not limited to rugs purchased from J & J Oriental Rugs, a Bijan Black Titanium 
“Royal Way” watch, and clothing purchased from House of Bijan and Alan 
Couture; 
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g. Evidence relevant to any false statements, pretenses, representations, or material 
omissions in connection with communications with the Department of Justice, the 
Internal Revenue Service, tax preparers, accountants, or banks; 

h. Communications, records, documents, and other files involving any of the 
attendees of the June 9, 2016 meeting at Trump tower, as well as Aras and Amin 
Agalorov; 

i. Evidence indicating Manafort’s state of mind as it relates to the crimes under 
investigation; 

j. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with Manafort about any matters relating to 
activities conducted by Manafort on behalf of, for the benefit of, or at the direction 
of any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

k. Any and all daily planners, logs, calendars, or schedule books relating to Manafort 
or Gates. 

2. Computers or storage media used as a means to commit the Subject Offenses. 

3. For any computer or storage medium whose seizure is otherwise authorized by 
this warrant, and any computer or storage medium that contains or in which is stored records or 
information that is otherwise called for by this warrant (hereinafter, “COMPUTER”): 

a. evidence of who used, owned, or controlled the COMPUTER at the time the 
things described in this warrant were created, edited, or deleted, such as logs, 
registry entries, configuration files, saved usernames and passwords, 
documents, browsing history, user profiles, email, email contacts, “chat,” 
instant messaging logs, photographs, and correspondence; 

b. evidence of software that would allow others to control the COMPUTER, 
such as viruses, Trojan horses, and other forms of malicious software, as well 
as evidence of the presence or absence of security software designed to detect 
malicious software; 

c. evidence of the lack of such malicious software; 

d. evidence indicating how and when the computer was accessed or used to 
determine the chronological context of computer access, use, and events 
relating to crime under investigation and to the computer user; 

e. evidence indicating the computer user’s state of mind as it relates to the crime 
under investigation; 

f. evidence of the attachment to the COMPUTER of other storage devices or 
similar containers for electronic evidence; 
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g. evidence of counter-forensic programs (and associated data) that are designed 
to eliminate data from the COMPUTER; 

h. evidence of the times the COMPUTER was used; 

i. passwords, encryption keys, and other access devices that may be necessary to 
access the COMPUTER; 

j. documentation and manuals that may be necessary to access the COMPUTER 
or to conduct a forensic examination of the COMPUTER; 

k. records of or information about Internet Protocol addresses used by the 
COMPUTER; 

l. records of or information about the COMPUTER’S Internet activity, including 
firewall logs, caches, browser history and cookies, “bookmarked” or 
“favorite” web pages, search terms that the user entered into any Internet 
search engine, and records of user-typed web addresses; 

m. contextual information necessary to understand the evidence described in this 
attachment. 

As used above, the terms “records” and “information” includes all forms of creation or 
storage, including any form of computer or electronic storage (such as hard disks or other media 
that can store data); any handmade form (such as writing); any mechanical form (such as printing 
or typing); and any photographic form (such as microfilm, microfiche, prints, slides, negatives, 
videotapes, motion pictures, or photocopies). 

The term “computer” includes all types of electronic, magnetic, optical, electrochemical, 
or other high speed data processing devices performing logical, arithmetic, or storage functions, 
including desktop computers, notebook computers, mobile phones, tablets, server computers, and 
network hardware. 

The term “storage medium” includes any physical object upon which computer data can 
be recorded. Examples include hard disks, RAM, floppy disks, flash memory, CD-ROMs, and 
other magnetic or optical media. 
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UNITED STATES DISTRICT COURT JJi £ c 

EASTERN DISTRICT OF VIRGINIA 

Alexandria Division 

Criminal No. l:17-sw-449 

Filed Under Seal 

AFFIDAVIT IN SUPPORT OF AN 
APPLICATION FOR A SEARCH WARRANT 

Federal Bureau of Investigation (“FBI”), being duly sworn, deposes and 

says: 

I. Introduction 
A. Affiant 

1. I am a Special Agent with the FBI and have been since 2015. I am currently 
assigned to the investigation being conducted by the Department of Justice Special Counsel. As a 
Special Agent of the FBI, I have received training and experience in investigating criminal and 
national security matters. Prior to my employment with the FBI, I spent seven years in the software 
industry and have extensive experience working with computer technology. 

2. I make this affidavit in support of an application pursuant to Rule 41 of the Federal 
Rules of Criminal Procedure for a warrant to search the premises located at 

Alexandria, Virginia 22314 (the “Subject Premises”), which is described more 
particularly in Attachment A, in order to locate and seize (and/or photograph) the items described 
in Attachment B. This affidavit is based upon my personal knowledge, my review of documents 
and other evidence, my conversations with other law enforcement personnel, and my training and 
experience. Because this affidavit is being submitted for the limited purpose of establishing 
probable cause, it does not include all the facts that I have learned during the course of my 
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investigation. Where the contents of documents and the statements, and conversations of others 
are reported herein, they are reported in substance and in pertinent part, except where otherwise 
indicated. 

B. The Subject Offenses 

3. For the reasons detailed below, there is probable cause to believe that the Subject 
Premises contain evidence, fruits, and instrumentalities of violations of: 31 U.S.C. §§ 5314, 
5322(a) (failure to file a report of foreign bank and financial accounts); 22 U.S.C. § 611, et. seq. 
(foreign agents registration act); 26 U.S.C. § 7206(1) (filing a false tax return); 18 U.S.C. § 1014 
(fraud in connection with the extension of credit); 18 U.S.C. §§ 1341,1343, and 1349 (mail fraud, 
wire fraud, and conspiracy to commit these offenses); 18 U.S.C. §§ 1956 and 1957 (money 
laundering and money laundering conspiracy); 52 U.S.C. §§ 30121(a)(1)(A) and (a)(2) (foreign 
contribution ban); and 18 U.S.C. §§371 and 2 (conspiracy, aiding and abetting, and attempt to 
commit such offenses) (collectively, the “Subject Offenses”). 
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65. indicated that Manafort used his home to do business and maintained 

records of his businesses at his home. For instance, some of the material that was moved to 

included files from Manafort’s former residence on^^^^^^^^^^^|in Alexandria, 
Virginia. indicated that Manafort was using his former residence as an office at the time. 

also advised the FBI that company documentation was being kept at the Subject 
Premises. In particular, informed the FBI that in late April or early May of 2017, Kathleen 
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Manafort told him that she and Manafort were reorganizing their lives and as part of that process 
were getting documents ready for meetings with their attorney. At the same time, saw 

miscellaneous documents on a coffee table at the Subject Premises, including but not limited to 
Federal Election Commission documents. 

66. also informed the FBI that one of the rooms in the Subject Premises is used 

as an office, and that has seen business records in that office, including in one or two 

drawers. Among the records maintained in the drawers were records related to Manafort’s various 
business entities, including John Hannah LLC (as discussed in Paragraph 16 above) and, he 
believes, DMP International, LLC. 

67. In an interview with the FBI on July 19, 2017, indicated that the last time 

he was inside the Subject Premises was on or about July 5, 2017, when he picked up Manafort’s 
mail and shipped a suit to another Manafort residence at Manafort’s request; and the last time he 
was at the Subject Premises was on or about July 11, 2017, when he took Kathleen Manafort to 
the airport. 

68. It is reasonable to believe that business records related to Manafort’s work in 

Ukraine, including historical records, would be maintained among the business files kept at the 
Subject Premises, including the files kept for use in consulting with counsel. On June 27, 2017, 
Manafort, Gates, and DMP International, LLC registered under FARA for the years 2012-2014 as 
a result of their political work in Ukraine, having failed to do so previously. This registration 
followed a series of communications between Manafort, his counsel, and officials in the United 
States Department of Justice’s National Security Division (which administers the FARA 
registration process) about the FARA requirements. At least one of these communications, dated 
September 13, 2016, was directed to Manafort Alexandria, VA, 
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i.e., the Subject Premises. It is therefore reasonable to believe that records relating to this filing 
(and thus related to Manafort’s failure to file previously) are maintained at the Subject Premises, 
including records of Manafort’s work on behalf of the Party of Regions and payments received 
from them. Among other things, in the Gates Interview, Gates told the FBI that Manafort and he 
used “standard English” common law contracts for their Ukrainian work and would invoice the 
customer for payment. 9 

69. These records are particularly valuable since counsel for Manafort has informed the 
United States Department of Justice that at least as of November 23, 2016, DMP International, 
LLC purports to have an “Email Retention Policy” which results in its not retaining 
“communications beyond thirty days.” In spite of its title, the policy purports to cover not just 
email, but “information that is either stored or shared via electronic mail or instant messaging 
technologies, and documentation residing on any computer or server.” The policy also purports 
to provide that “[e]ach employee may at its [sic] discretion archive certain electronic information 
that pertains to the company’s business or mission,” but the the employee “must do so with the 
knowledge that all emails, electronic documents and other electronic material shall be deleted from 
corporate equipment, including but not limited to, computers, servers, and mobile devices, within 
30 days of possession of the information.” 

70. There is also probable cause to believe that the Subject Premises contains records 
related to Manafort’s efforts to secure loans from TFSB on the basis of inconsistent representations 
about his income and net worth, as described above. Records obtained from TFSB show that in 

9 In contrast, in their June 27,2017, FARA filings. Gates, Manafort, and DMP International, LLC 
indicated that there was no formal written contract of exchange of correspondence between the 
parties. In such circumstances, the FARA form requires the filer to “give a complete description” 
of the terms and conditions of the oral agreement or understanding, its duration, the fees and 
expenses, if any, to be received.” The June 2017 filings provide none of that information. 
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approximately August 2016, Manafort submitted bank statements for two accounts at Citi to TFSB 
in connection with his application for lending. One of the two bank statements submitted to TFSB 
is addressed to Kathleen Manafort at the address of the Subject Premises. Bank records also show 
that beginning in December 2016, bank statements for the other account were directed to the same 
address. Accordingly, there is probable cause to believe that bank statements and other 
documentation related to those accounts, which formed part of the TFSB’s consideration of 
Manafort’s request for lending, could be found at the Subject Premises. 

71. Additionally, there is probable cause to believe that other financial records relevant 
to the Subject Offenses will be found at the Subject Premises. Manafort’s prior residence in 
Alexandria, was listed as the address of record for a number of 

accounts, including accounts at First Republic Bank in Chicago that were closed in 2014 following 
anti-money laundering concerns by the bank, as discussed in Paragraph 16 above. From my 
training and experience, I am aware that individuals and businesses often retain copies of financial 
records for several years, including in connection with tax filing obligations. Accordingly, and 
given the fact that Manafort and his wife moved to the Subject Premises from his prior residence 
in the same city in approximately May of 2015, it is reasonable to believe that finahcial records 
sent to his prior residence may be found at the Subject Premises. Additionally, a mail cover 
conducted by the FBI, involving the review of the outside cover of United States Postal Service 
(USPS) mail addressed to the Subject Premises, reveals that during the period between 
approximately June 13, 2017 and July 12, 2017, mail to the Subject Premises included, among 
other things, a first class mailing from TSFB (the lender described above), mail from M&T Bank, 
and a statement from American Express addressed to both Paul Manafort and “Davis Manafort 
Part,” which I believe to refer to Davis Manafort Partners. 
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72. Further, there is probable cause to believe that the Subject Premises contains 

physical evidence in the form of physical items purchased through the use of funds from foreign 
bank accounts, including from the Cypriot bank accounts described above. For instance, given 
that Manafort lives at the premises, there is probable cause to believe that men’s clothing and 
accessories purchased at one or both of the clothing vendors and paid for by wire transfers from 
various Cyprus accounts, as referenced in Paragraph 14 above, will be found at the Subject 
premises. Bank records and records obtained from the clothiers show that between 2009 and 2012, 
Manafort purchased more than approximately $760,000 in merchandise from these two clothiers 
using funds wired from several of the Cypriot accounts. Purchases included multiple suits and 
jackets in excess of $10,000 and at least one limited edition Bijan Black Titanium “Royal Way” 
watch, purchased for $21,000. Between approximately 2009 and spring 2015, invoices for 
Manafort’s purchases from Alan Couture were sent to Manafort’s previous Alexandria residence 
on Mount Vernon Circle; more recently, invoices have been sent to Manafort at the Subject 
Premises. According to there are two closets at the Subject Premises that contain clothing 

and jewelry. 

73. There is also reason to believe that rugs purchased with funds from the Cypriot 
accounts would be found at the Subject Premises. Wire transfers totaling more than $360,000 
were sent from Cypriot accounts directly to J & J Oriental Rugs, a carpet store located in 
Alexandria, Virginia, near to the Subject Premises. The funds were used to pay for rugs acquired 
by Manafort. In an interview with the FBI, one of the owners of J & J Oriental Rugs advised that 
Manafort brought several of his purchases back to the store for cleaning, which remain at the store. 
It is reasonable to believe that the remaining rugs purchased by Manafort with funds funneled 
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through the Cypriot accounts will be found at the Subject Premises (to include Premises’ storage 
unit). 

74. Although I submit that there is probable cause to seize the aforementioned rugs and 
clothing as fruits of the Subject Offenses, the FBI does not intend to seize those items. Rather, 
upon an authorized search of the Subject Premises, the FBI intends to identify and photograph 
those items. 

Computers, Electronic Storage, and Forensic Analysis 

75. As described in Attachment B, this application seeks permission to search for 
records that might be found on the Subject Premises, in whatever form they are found. One form 
in which the records might be found is data stored on a computer’s hard drive or other storage 
media. 10 Thus, the warrant applied for would authorize the seizure of electronic storage media or, 
potentially, the copying of electronically stored information, all under Rule 41(e)(2)(B). 

76. In a July 2017 interview. advised the FBI that there is a Mac desktop 

computer on the desk in the office at the Subject Premises, which is used by Manafort. For a 
variety of reasons, copies of historical records and current records are also frequently stored on 
external hard drives, thumb drives, and magnetic disks. There is reasonable cause to believe such 
media may be contained in and among records of Manafort’s business and financial activity at the 
Subject Premises. FBI interviews of[H further confirm that Manafort has made widespread 
use of electronic media in the course of his business activity. For example, told the FBI 

that Manafort had a drawer full of phones and electronic equipment at his old residence in Mount 
Vernon Square. At one point, Manafort gave a bag of computers and directed to 

10 A storage medium is any physical object upon which computer data can be recorded. Examples 
include hard disks, RAM, floppy disks, flash memory, CD-ROMs, and other magnetic or optical 
media. 
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have the drives wiped before giving them to charity. Manafort also gave several additional 

devices, both laptops and cellular phones. 

77. I submit that there is probable cause to believe that evidence of the Subject Offenses 
may be found on storage media located at the Subject Premises, including but not limited to a 
desktop computer, for at least the following reasons: 

a. Based on my knowledge, training, and experience, I know that computer files or 
remnants of such files can be recovered months or even years after they have been 
downloaded onto a storage medium, deleted, or viewed via the Internet. 

Electronic files downloaded to a storage medium can be stored for years at little 
or no cost. Even when files have been deleted, they can be recovered months or 
years later using forensic tools. This is so because when a person “deletes” a file 
on a computer, the data contained in the file does not actually disappear; rather, 
that data remains on the storage medium until it is overwritten by new data. 

b. Therefore deleted files, or remnants of deleted files, may reside in free space or 
slack space - that is, in space on the storage medium that is not currently being used 
by an active file -for long periods of time before they are overwritten. In addition, 
a computer’s operating system may also keep a record of deleted data in a “swap” 
or “recovery” file. 

c. Wholly apart from user-generated files, computer storage media - in particular, 
computers’ internal hard drives - contain electronic evidence of how a computer 
has been used, what it has been used for, and who has used it. To give a few 
examples, this forensic evidence can take the form of operating system 
configurations, artifacts from operating system or application operation, file system 
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data structures, and virtual memory “swap” or paging files. Computer users 
typically do not erase or delete this evidence, because special software is typically 
required for that task. However, it is technically possible to delete this information. 

78. Forensic evidence. As further described in Attachment B, this application seeks 
permission to locate not only computer files that might serve as direct evidence of the crimes 
described on the warrant, but also for forensic electronic evidence that establishes how computers 
were used, the purpose of their use, who used them, and when. There is probable cause to believe 
that this forensic electronic evidence will be on any storage medium in the Subject Premises 
because: 

a. Data on the storage medium can provide evidence of a file that was once on the 
storage medium but has since been deleted or edited, or of a deleted portion of a 
file (such as a paragraph that has been deleted from a word processing file). Virtual 
memory paging systems can leave traces of information on the storage medium that 
show what tasks and processes were recently active. Web browsers, e-mail 
programs, and chat programs store configuration information on the storage 
medium that can reveal information such as online nicknames and passwords. 
Operating systems can record additional information, such as the attachment of 
peripherals, the attachment of USB flash storage devices or other external storage 
media, and the times the computer was in use. Computer file systems can record 
information about the dates files were created and the sequence in which they were 
created, although this information can later be falsified. 

b. As explained herein, information stored within a computer and other electronic 
storage media may provide crucial evidence of the “who, what, why, when, 
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where, and how” of the criminal conduct under investigation, thus enabling the 
United States to establish and prove each element or alternatively, to exclude the 
innocent from further suspicion. In my training and experience, information 
stored within a computer or storage media (e.g., registry information, 
communications, images and movies, transactional information, records of 
session times and durations, internet history, and anti-virus, spyware, and 
malware detection programs) can indicate who has used or controlled the 
computer or storage media. This “user attribution” evidence is analogous to the 
search for “indicia of occupancy” while executing a search warrant at a residence. 
The existence or absence of anti-virus, spyware, and malware detection programs 
may indicate whether the computer was remotely accessed, thus inculpating or 
exculpating the computer owner. Further, computer and storage media activity 
can indicate how and when the computer or storage media was accessed or used. 
For example, as described herein, computers typically contain information that 
log: computer user account session times and durations, computer activity 
associated with user accounts, electronic storage media that connected with the 
computer, and the IP addresses through which the computer accessed networks 
and the internet. Such information allows investigators to understand the 
chronological context of computer or electronic storage media access, use, and 
events relating to the crime under investigation. Additionally, some information 
stored within a computer or electronic storage media may provide crucial 
evidence relating to the physical location of other evidence and the suspect. For 
example, images stored on a computer may both show a particular location and 
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have geolocation information incorporated into its file data. Such file data 
typically also contains information indicating when the file or image was created. 
The existence of such image files, along with external device connection logs, 
may also indicate the presence of additional electronic storage media (e.g., a 
digital camera or cellular phone with an incorporated camera). The geographic 
and timeline information described herein may either inculpate or exculpate the 
computer user. Last, information stored within a computer may provide relevant 
insight into the computer user’s state of mind as it relates to the offense under 
investigation. For example, information within the computer may indicate the 
owner’s motive and intent to commit a crime (e.g., internet searches indicating 
criminal planning), or consciousness of guilt (e.g., running a “wiping” program to 
destroy evidence on the computer or password protecting/encrypting such 
evidence in an effort to conceal it from law enforcement). 

c. A person with appropriate familiarity with how a computer works can, after 
examining this forensic evidence in its proper context, draw conclusions about 
how computers were used, the purpose of their use, who used them, and when. 

d. The process of identifying the exact files, blocks, registry entries, logs, or other 
forms of forensic evidence on a storage medium that are necessary to draw an 
accurate conclusion is a dynamic process. While it is possible to specify in 
advance the records to be sought, computer evidence is not always data that can 
be merely reviewed by a review team and passed along to investigators. Whether 
data stored on a computer is evidence may depend on other information stored on 
the computer and the application of knowledge about how a computer behaves. 
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Therefore, contextual information necessary to understand other evidence also 
falls within the scope of the warrant. 

e. Further, in finding evidence of how a computer was used, the purpose of its use, 
who used it, and when, sometimes it is necessary to establish that a particular 
thing is not present on a storage medium. For example, the presence or absence 
of counter-forensic programs or anti-virus programs (and associated data) may be 
relevant to establishing the user’s intent. 

79. Necessity of seizing or copying entire computers or storage media. In most cases, 
a thorough search of a premises for information that might be stored on storage media often 
requires the seizure of the physical storage media and later off-site review consistent with the 
warrant. In lieu of removing storage media from the premises, it is sometimes possible to make 
an image copy of storage media. Generally speaking, imaging is the taking of a complete 
electronic picture of the computer’s data, including all hidden sectors and deleted files. Either 
seizure or imaging is often necessary to ensure the accuracy and completeness of data recorded 
on the storage media, and to prevent the loss of the data either from accidental or intentional 
destruction. This is true because of the following: 

a. The time required for an examination. As noted above, not all evidence takes the 
form of documents and files that can be easily viewed on site. Analyzing 
evidence of how a computer has been used, what it has been used for, and who 
has used it requires considerable time, and taking that much time on premises 
could be unreasonable. As explained above, because the warrant calls for forensic 
electronic evidence, it is exceedingly likely that it will be necessary to thoroughly 
examine storage media to obtain evidence. Storage media can store a large 
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volume of information. Reviewing that information for things described in the 
warrant can take weeks or months, depending on the volume of data stored, and 
would be impractical and invasive to attempt on-site. 

b. Technical requirements. Computers can be configured in several different ways, 
featuring a variety of different operating systems, application software, and 
configurations. Therefore, searching them sometimes requires tools or knowledge 
that might not be present on the search site. The vast array of computer hardware 
and software available makes it difficult to know before a search what tools or 
knowledge will be required to analyze the system and its data on the Subject 
Premises. However, taking the storage media off-site and reviewing it in a 
controlled environment will allow its examination with the proper tools and 
knowledge. 

c. Variety of forms of electronic media. Records sought under this warrant could be 
stored in a variety of storage media formats that may require off-site reviewing 
with specialized forensic tools. 

80. Nature of examination. Based on the foregoing, and consistent with Rule 
41(e)(2)(B), the warrant I am applying for would permit seizing, imaging, or otherwise copying 
storage media that reasonably appear to contain some or all of the evidence described in the 
warrant, and would authorize a later review of the media or information consistent with the 
warrant. The later review may require techniques, including but not limited to computer-assisted 
scans of the entire medium, that might expose many parts of a hard drive to human inspection in 
order to determine whether it is evidence described by the warrant. 
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81. Based on the foregoing, I respectfully submit there is probable cause to believe that 
the Subject Offenses have been committed and that there is probable cause that evidence of the 
Subject Offenses, as described in Attachment B, is to be found at the Subject Premises. 

in. Conclusion and Ancillary Provisions 

82. Based on the foregoing, I respectfully request the Court to issue a warrant to search 
the Subject Premises, as described in Attachment A to this affidavit, and to seize the items and 
information specified in Attachment B. 

83. In light of the confidential and highly sensitive nature of the continuing 
investigation, I respectfully request that this affidavit and all papers submitted herewith be 
maintained under seal until the Court orders otherwise. 


Respectfully submitted, 



Sworrito before me on 
July 2 -' 5 ,2017 


Special Agent 
Federal Bureau of Investigation 


/s/ 




Theresa Carroll Buchanan 
United States Magistrate Judge 
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ATTACHMENT A 
The Property to Be Searched 


The premises to be searched (the “Subject Premises”) is the condominium unit located at 
Alexandria, VA 22314, including the storage unit numbered 


| as well as any locked drawers, containers, cabinets, safes, computers, electronic devices, and 


storage media (such as hard disks or other media that can store data) found therein. 
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ATTACHMENT B 


Items to Be Seized (or, in the alternative, identified) 

1. Records relating to violations of 31 U.S.C. §§ 5314,5322(a) (failure to file a report 
of foreign bank and financial accounts); 22 U.S.C. § 611, el. seq. (foreign agents registration act); 
26 U.S.C. § 7206(1) (filing a false tax return); 18 U.S.C. § 1014 (fraud in connection with the 
extension of credit); 18 U.S.C. §§ 1341,1343, and 1349 (mail fraud, wire fraud, and conspiracy to 
commit these offenses); 18 U.S.C. §§ 1956 and 1957 (money laundering and money laundering 
conspiracy); 52 U.S.C. §§ 30121(a)(1)(A) and (a)(2) (foreign national contributions); and 18 
U.S.C. §§ 371 and 2 (conspiracy, aiding and abetting, and attempt to commit such offenses) 
(collectively, the “Subject Offenses”), occurring on or after January I, 2006, including but not 
limited to: 

a. Any and all financial records for Paul Manafort, Jr., Kathleen Manafort, Richard 

Gates, or companies associated with Paul Manafort, Jr., Kathleen Manafort, or 
Richard Gates, including but not limited to records relating to any foreign financial 
accounts and records relating to payments by or on behalf of any foreign 

government, foreign officials, foreign entities, foreign persons, or foreign 

principals; 

b. Any and all federal and state tax documentation, including but not limited to 
personal and business tax returns and all associated schedules for Paul Manafort, 
Jr., Richard Gates, or companies associated with Manafort or Gates; 

c. Letters, correspondence, emails, or other forms of communications with any 
foreign financial institution, or any individual acting as the signatory or controlling 
any foreign bank account; 

d. Records relating to efforts by Manafort, Gates, or their affiliated entities to conduct 

activities on behalf of, for the benefit of, or at the direction of any foreign 

government, foreign officials, foreign entities, foreign persons, or foreign 

principals, including but not limited to the Party of Regions and Viktor 
Yanukovych; 

e. Records relating to, discussing, or documenting Telmar Investments Limited, 
Tiakora Ventures Limited, Lucicle Consultants Limited, Actinet Trading Limited, 
Black Sea View Limited, Bletilla Ventures Limited, Evo Holdings Limited, Global 
Highway Limted, Leviathan Advisors Limited, Loav Advisors Limited, Peranova 
Holdings Limited, including but not limited to bank records, canceled checks, 
money drafts, lettere of credit, cashier’s checks, safe deposit records, checkbooks, 
and check stubs, duplicates and copies of checks, deposit items, savings passbooks, 
wire transfer records, and similar bank and financial account records; 

f. Physical items purchased through the use of funds from Cypriot accounts, including 
but not limited to rugs purchased from J & J Oriental Rugs, a Bijan Black Titanium 
“Royal Way” watch, and clothing purchased from House of Bijan and Alan 
Couture; 
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g. Evidence relevant to any false statements, pretenses, representations, or material 
omissions in connection with communications with the Department of Justice, the 
Internal Revenue Service, tax preparers, accountants, or banks; 

h. Communications, records, documents, and other files involving any of the 
attendees of the June 9, 2016 meeting at Trump tower, as well as Aras and Amin 
Agalorov; 

i. Evidence indicating Manafort’s state of mind as it relates to the crimes under 
investigation; 

j. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with Manafort about any matters relating to 
activities conducted by Manafort on behalf of, for the benefit of, or at the direction 
of any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

k. Any and all daily planners, logs, calendars, or schedule books relating to Manafort 
or Gates. 

2. Computers or storage media used as a means to commit the Subject Offenses. 

3. For any computer or storage medium whose seizure is otherwise authorized by 
this warrant, and any computer or storage medium that contains or in which is stored records or 
information that is otherwise called for by this warrant (hereinafter, “COMPUTER”): 

a. evidence of who used, owned, or controlled the COMPUTER at the time the 
things described in this warrant were created, edited, or deleted, such as logs, 
registry entries, configuration files, saved usernames and passwords, 
documents, browsing history, user profiles, email, email contacts, “chat,” 
instant messaging logs, photographs, and correspondence; 

b. evidence of software that would allow others to control the COMPUTER, 
such as viruses, Trojan horses, and other forms of malicious software, as well 
as evidence of the presence or absence of security software designed to detect 
malicious software; 

c. evidence of the lack of such malicious software; 

d. evidence indicating how and when the computer was accessed or used to 
determine the chronological context of computer access, use, and events 
relating to crime under investigation and to the computer user; 

e. evidence indicating the computer user’s state of mind as it relates to the crime 
under investigation; 

f. evidence of the attachment to the COMPUTER of other storage devices or 
similar containers for electronic evidence; 
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g. evidence of counter-forensic programs (and associated data) that are designed 
to eliminate data from the COMPUTER; 

h. evidence of the times the COMPUTER was used; 

i. passwords, encryption keys, and other access devices that may be necessary to 
access the COMPUTER; 

j. documentation and manuals that may be necessary to access the COMPUTER 
or to conduct a forensic examination of the COMPUTER; 

k. records of or information about Internet Protocol addresses used by the 
COMPUTER; 

l. records of or information about the COMPUTER’S Internet activity, including 
firewall logs, caches, browser history and cookies, “bookmarked” or 
“favorite” web pages, search terms that the user entered into any Internet 
search engine, and records of user-typed web addresses; 

m. contextual information necessary to understand the evidence described in this 
attachment. 

As used above, the terms “records” and “information” includes all forms of creation or 
storage, including any form of computer or electronic storage (such as hard disks or other media 
that can store data); any handmade form (such as writing); any mechanical form (such as printing 
or typing); and any photographic form (such as microfilm, microfiche, prints, slides, negatives, 
videotapes, motion pictures, or photocopies). 

The term “computer” includes all types of electronic, magnetic, optical, electrochemical, 
or other high speed data processing devices performing logical, arithmetic, or storage functions, 
including desktop computers, notebook computers, mobile phones, tablets, server computers, and 
network hardware. 

The term “storage medium” includes any physical object upon which computer data can 
be recorded. Examples include hard disks, RAM, floppy disks, flash memory, CD-ROMs, and 
other magnetic or optical media. 
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